🔀

Sub-flow: Authenticate via Email Verification Code SUC-IDP-01

This page is a sub-flow invoked from another use case — when finished, control returns to the caller.

Verification Code

Enter the 6-digit code sent to your contact

Channel Email

Sent to user@example.com

Verification Code *

Expires in 5:00 REF: REF-XXXXX

Change Method

Screen Flow (per flow.puml):

✓ Finish & Return to caller (verification code correct) ✕ Cancel sub-flow (change method)

📝 Spec notes — SUC-IDP-01 / SCR-IDP.02 (fields, actions, requirements)

Identity

SUC: SUC-IDP-01 — Authenticate via email verification code
Screen: SCR-IDP.02 — Verification Code
Invoked by (Learner Portal): UC-IDP.01 (Register as Learner), UC-IDP.09 (Update Learner Profile), UC-IDP.22 (Forgot Password)

ReturnUrl context

Current: /forgot-password/reset-password
Fallback: / when returnUrl is empty
Finish → returnUrl; Cancel → cancelUrl (if provided) or returnUrl + &sub_cancelled=1
cancelUrl: /forgot-password/

Brief description

6-digit email verification code sub-flow. System sends the code before opening this page; user enters it; system verifies. Handles wrong code (inline error + retry), expired code (inline message + auto-resend), resend throttling, and 5-failure inline lockout (AF 3C / SS-IDP.01) — all without page redirect.

Regions

Verification Code Delivery Info — Channel (read-only), Sent to (read-only, always unmasked)
Verification Code Entry — Verification Code (required, 6-digit numeric), Expires in (live countdown), REF (read-only)
Footer Actions — Verify, Resend Verification Code, Change Method

Fields

delivery_channel "Channel" — text · read-only · source: session.otp_channel · always
contact "Sent to" — text · read-only · source: session.contact_full (full unmasked — AR-7) · always
otp_code "Verification Code" — text · required · always · validation: length:6, digits_only
countdown_remaining "Expires in" — text · read-only · computed · always
ref_key "REF" — text · read-only · source: session.otp_ref_key · always

Actions

verify "Verify" — enabled when otp_code.length == 6 && !locked · triggers SUC-IDP-01-M-2
resend "Resend verification code" — enabled when not locked · triggers SUC-IDP-01-A-3A-2
change_method "Change Method" — always · back navigation to calling UC's method-selection screen

Additional requirements

5-minute countdown (SS-IDP.02); at 0:00 → inline expiry message + prompt Resend. [SS-IDP.02]
Inline error below otp_code on invalid code: "Invalid verification code — please try again." [—]
Auto-focus otp_code on page load; Verify enabled only when 6 digits filled. [NFR-09]
AF 3C inline lockout: 5 wrong attempts → disable input + Resend, show lock panel with 15-min countdown; auto-reopen when lock expires. [SS-IDP.01]
Resend during lock window → "You cannot request a new verification code at this time — please wait 15 minutes." [SS-IDP.01]
"Change Method" navigates back to the method-selection screen of the calling UC; target not hardcoded. [—]
contact always displayed full and unmasked — email: full address; SMS: full number (e.g. +66812345678). session.contact_full must carry the unmasked value. [—]